I have a search triggering for a certain failed threshold for a monitored value. Instead of making 7 alerts one per customer, I made one search and one alert creating a table of results. Hence I needed to use the "Trigger for each result" option in alerts.
Then I needed to suppress per customer when the trigger value exceeded threshold. My alert searches every minute for the last 15 minutes, and is supposed to throttle for 15 minutes on hit.
Googling and documentation suggest setting 'customer' field in the "Suppress results containing field value" text box in Splunk. This did not suppress when "For each result" was enabled, and I got an alert every minute.